Tunneling is a method of transporting data across a network using protocols that are not supported

by that network. Tunneling works by encapsulating packets: wrapping packets inside of other

packets. Tunneling within commonly used services is a technique that uses file sharing or an instant

messenger client such as Meebo running over HTTP to bypass firewalls or other network restrictions.

The data packets are encapsulated within HTTP packets and sent as normal web traffic. This way, the

data packets can reach their destination without being blocked or detected by the

network. Reference: What is tunneling? | Tunneling in networking | Cloudflare, What Is Network

Tunneling & How Is It Used? | Traefik Labs, networking - What is HTTP tunneling? - Stack Overflow

"The WildFire cloud-based malware analysis environment is a cyber threat prevention service that

identifies unknown malware, zero-day exploits, and advanced persistent threats (APTs) through static

and dynamic analysis in a scalable, virtual environment. WildFire automatically disseminates

updated protections in near-real time to immediately prevent threats from spreading; this occurs

without manual intervention"

A credit card number is an example of PII that you need to prevent from leaving your enterprise

network. PII, or personally identifiable information, is any information that can be used to identify an

individual, either alone or in combination with other data. PII can be sensitive or non-sensitive,

depending on the level of protection required and the potential harm if exposed. Sensitive PII

includes data that can directly identify an individual and cause significant harm if leaked or stolen,

such as financial information, medical records, or government-issued ID numbers. Non-sensitive PII

includes data that is easily accessible from public sources and does not pose a high risk of identity

theft, such as zip code, race, or gender. A credit card number is a sensitive PII because it can be used

to access the cardholder’s account, make fraudulent transactions, or steal their identity. Therefore, it

is important to prevent credit card numbers from leaving the enterprise network, where they could

be intercepted by hackers, malicious insiders, or third parties. To protect credit card numbers and

other sensitive PII, enterprises should implement data security measures such as encryption,

tokenization, masking, access control, auditing, and monitoring. Additionally, enterprises should

comply with data privacy laws and standards that regulate the collection, use, and protection of PII,

such as the Payment Card Industry Data Security Standard (PCI DSS), the General Data Protection

Regulation (GDPR), or the California Consumer Privacy Act (CCPA). Reference:

What is PII? Examples, laws, and standards | CSO Online

What is Personally Identifiable Information (PII)? | IBM

What Is Personally Identifiable Information (PII)? Types and Examples

What is PII (personally identifiable information)? - Cloudflare

What is Personally Identifiable Information (PII)? - Data Privacy Manager

Port hopping is a technique that changes protocols at random during a session to evade detection

and analysis by security devices. Port hopping can be used by malware or attackers to communicate

with command and control servers or to exfiltrate data. Port hopping makes it difficult to identify and

block malicious traffic based on port numbers or signatures. Reference: Port Hopping, Ports Used for

Management Functions, Adding a Custom Application/Ports to Security Policy

The URL Filtering service complements App-ID by enabling you to configure the next-generation

firewall to identify and control access to websites and to protect your organization from websites

that host malware and phishing pages.

Docker and bare metal hypervisor are two different types of virtualization technologies that have

different functioning mechanisms, architectures, and use cases. Docker is a containerization

technology that allows users to create, deploy, and run applications using containers. Containers are

isolated environments that share the same host operating system kernel, but have their own

libraries, dependencies, and resources. Docker can run multiple containers on the same host,

without requiring a separate operating system for each container12. Bare metal hypervisor, also

known as type 1 hypervisor, is a software that runs directly on the hardware and creates virtual

machines. Virtual machines are complete operating systems that have their own kernel, drivers, and

resources. Bare metal hypervisor can run multiple virtual machines on the same host, each with a

different operating system and dedicated resources3 .

The main difference between Docker and bare metal hypervisor is the level of abstraction they

provide. Docker uses OS-level virtualization, which means it creates containers on top of the host

operating system. Bare metal hypervisor uses hardware virtualization, which means it runs

independently from the host operating system and creates virtual machines on the hardware layer.

This difference has implications for the performance, efficiency, and portability of the virtualized

environments. Docker containers are generally faster, lighter, and more scalable than virtual

machines, as they do not have the overhead of running a separate operating system for each

container. However, Docker containers are more limited and can run only on Linux, certain Windows

servers and IBM mainframes if hosted on bare metal. Virtual machines, on the other hand, are more

flexible and secure, as they can run any operating system and isolate the guest operating system

from the host operating system. However, virtual machines are more resource-intensive and slower

than containers, as they have to emulate the hardware and run a full operating system for each

virtual machine12.

Reference:

Docker vs VMWare: How Do They Stack Up? | UpGuard

Hypervisor vs. Docker: Complete Comparison of the Two - HitechNectar

Beginners Track - Docker On Bare Metal | dockerlabs

[Getting Started: Layer 3 Subinterfaces - Palo Alto Networks Knowledge Base]

OSPF is a link-state routing protocol that requires all routers in the same domain to maintain a map

of the network. This map is called the link-state database (LSDB) and it contains information about

the topology and the state of each link. Each router independently calculates the shortest path to

every destination in the network using the Dijkstra algorithm. OSPF routers exchange routing

information by flooding link-state advertisements (LSAs) to their neighbors. LSAs are acknowledged

by the receivers to ensure reliable delivery12. Reference:

What Is OSPF? Understanding Network Protocols By WireX Systems

Routing Protocols Overview - Global Knowledge

A “ports first” data security solution is a traditional approach that relies on port numbers to identify

and filter network traffic. This approach has several limitations and security weaknesses, such as12:

Port numbers are not reliable indicators of the type or content of network traffic, as they can be

easily spoofed or changed by malicious actors.

Port numbers do not provide any visibility into the application layer, where most of the attacks occur.

Port numbers do not account for the dynamic and complex nature of modern applications, which

often use multiple ports or protocols to communicate.

Port numbers do not support granular and flexible policies based on user identity, device context, or

application behavior. One of the security weaknesses that is caused by implementing a “ports first”

data security solution in a traditional data center is that you may have to open up multiple ports and

these ports could also be used to gain unauthorized entry into your datacenter. For example, if you

have a web server that runs on port 80, you may have to open up port 80 on your firewall to allow

incoming traffic. However, this also means that any other service or application that uses port 80 can

also access your datacenter, potentially exposing it to attacks. Moreover, opening up multiple ports

increases the attack surface area of your network, as it creates more entry points for attackers to

exploit34. Reference: Common Open Port Vulnerabilities List - Netwrix, Optimize security with Azure

Firewall solution for Azure Sentinel | Microsoft Security Blog, Which item accurately describes a

security weakness that is caused by …, Which item accurately describes a security weakness … -

Exam4Training

As containers grew in popularity and used diversified orchestrators such as Kubernetes (and its

derivatives, such as OpenShift), Mesos, and Docker Swarm, it became increasingly important to

deploy and operate containers at scale.

https://www.dynatrace.com/news/blog/kubernetes-vs-docker/

Attack communication traffic is usually hidden with various techniques and

tools, including:

● Encryption with SSL, SSH (Secure Shell), or some other custom or proprietary encryption

● Circumvention via proxies, remote access tools, or tunneling. In some instances, use of

cellular networks enables complete circumvention of the target network for attack C2 traffic.

● Port evasion using network anonymizers or port hopping to traverse over any available open

ports

● Fast Flux (or Dynamic DNS) to proxy through multiple infected endpoints or multiple,

ever-changing C2 servers to reroute traffic and make determination of the true destination

or attack source difficult

● DNS tunneling is used for C2 communications and data infiltration